How to disable DNS lookups in SiteMinder Web Agent (ACO configuration)

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On
• SITEMINDER
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)

Issue/Introduction

This article describes the procedure to disable DNS resolution in the SiteMinder Web Agent. Disabling this function prevents the Web Agent from performing forward or reverse DNS lookups, which can resolve issues where the Web Agent attempts to resolve external hostnames or IP addresses unnecessarily, often resulting in performance degradation or connectivity errors behind NAT firewalls.

Environment

Environment:

• SiteMinder Web Agent (all supported versions)
• Web Server (IIS, Apache, etc.)

Cause

The default behavior of the Web Agent is to perform DNS resolution. In specific environments, such as those behind NAT firewalls or when handling non-standard URL headers (e.g., https://..../randomstuf?=example.com), this resolution can fail or cause performance delays.

Resolution

To disable DNS lookups, modify the Agent Configuration Object (ACO) as follows:

1. Log in to the SiteMinder Administrative UI.
2. Navigate to the Agent Configuration Object used by the Web Agent.
3. Locate the DisableDNSLookup parameter.
4. Set the value to yes. Note: Ensure the parameter name ends with 'p' (DisableDNSLookup) and not 's'.
5. Save the configuration.
6. Stop and start the Web Agent to apply the changes.

Additional Information:

• For more technical details on DNS lookup behavior, see ACO DisableDNSLookup behavior clarification and details in Web Agent (Article 11079).
• If you encounter issues processing requests behind a NAT firewall, refer to Fails to Process Requests Behind a NAT Firewall Due to DNS Resolution in Web Agent (Article 76231).
• If you need further assistance, please visit Contact Broadcom Support

Difference in Web Agent logs and network traces show below : 

DisableDNSLookup=NO 

[05/30/2014][05:35:51][22507][1143875904][CSmHttpPlugin.cpp:345][CSmHttpPlugin::ProcessResource][<Transaction ID>][][][][][][Resolved HTTP_HOST: '##.#.#.#'.] 

[05/30/2014][05:35:51][22507][1143875904][CSmHttpPlugin.cpp:3772][Entered CSmHttpPlugin:: ResolveFQServerName sHost: ][][][][][][][##.#.#.#]

[05/30/2014][05:35:51][22507][1143875904][CSmHttpPlugin.cpp:426][CSmHttpPlugin::ProcessResource][<Transaction ID>][][][][][][Resolved hostname: '_host.example.com'.] 


DisableDNSLookup=YES

[05/30/2014][05:39:37][22617][1124198720][CSmHttpPlugin.cpp:345][CSmHttpPlugin::ProcessResource][<Transaction ID>][][][][][][Resolved HTTP_HOST: '##.#.#.#'.]

[05/30/2014][05:39:37][22617][1124198720][CSmHttpPlugin.cpp:3772][Entered CSmHttpPlugin::ResolveFQServerName sHost: ][][][][][][][##.#.#.#]

[05/30/2014][05:39:37][22617][1124198720][CSmHttpPlugin.cpp:3848][CSmHttpPlugin::ResolveFQServerName: isIP][][][][][][][10.0.0.1] 

[05/30/2014][05:39:37][22617][1124198720][CSmHttpPlugin.cpp:3967][CSmHttpPlugin::ResolveFQServerName, DNSLookups disabled, checking to see if cookiedomain added!][][][][][][][##.#.#.#]

[05/30/2014][05:39:37][22617][1124198720][CSmHttpPlugin.cpp:426][CSmHttpPlugin::ProcessResource][<Transaction ID>][][][][][][Resolved hostname: '##.#.#.#'.]